Immutable Linux Delivers Serious Security - Here Are Your 5 Best Options

Jack Wallen / Elyse Betters Picaro / ZDNET

Follow ZDNET: Add america arsenic a preferred source connected Google.

ZDNET's cardinal takeaways

• An immutable distribution increases nan information of nan OS.
• Linux offers respective different immutable distributions.
• Most of these are general-purpose, truthful anyone tin usage them.

What is an "immutable" Linux distribution?

Put simply, an immutable distro is 1 successful which definite directories are read-only and cannot beryllium changed. For example, nan /usr directory contains galore of your applications' binary executable files and is mounted read-only. Other directories mounted pinch only publication permissions see /lib (essential shared libraries for strategy operation), /opt (used for optional package packages), and /var (stores adaptable data).

Also: What is immutable Linux? Here's why you'd tally an immutable Linux distro

By mounting nan directories that location exertion executables read-only, those apps cannot beryllium swapped retired for malicious counterfeits, which could harm your strategy aliases bargain your data. 

How does an immutable distro work?

Here's really that works:

1. The strategy creates a moving image anterior to nan upgrade.
2. The upgrade happens.
3. The machine must beryllium rebooted for nan upgrade to apply.
4. If thing goes incorrect during nan upgrade, nan recently created image is applied, truthful you're backmost wherever you started.

With an immutable distribution, you ne'er person to interest astir an upgrade breaking things.   

My workfellow Steven Vaughan-Nichols goes into much item connected the ins and outs of immutable distros.

Now that I've sold you connected immutable distributions, you mightiness beryllium wondering what options are available. Here are my 5 favorites.

1. carbonOS

CarbonOS was designed to beryllium intuitive and robust. What does that moreover mean? Well, carbonOS uses nan GNOME desktop to fundamentally get retired of your way, truthful you tin attraction much connected what you want/need to do. With carbonOS, each strategy files are mounted read-only, and installed apps are sandboxed, truthful they are isolated from 1 another. 

Also: How to tally a Windows app connected Linux pinch Wine

One point to cognize astir carbonOS is that it's an independent distribution -- it doesn't usage Ubuntu, Fedora, Arch, openSUSE, aliases immoderate different distribution arsenic its foundation. Because of this, carbonOS is not beholden to different distribution, truthful it tin enactment independently. That independency allows nan improvement squad to attraction connected nan users, crafting an OS that is user-friendly, stable, and fun. 

CarbonOS adheres to definite guidelines: a refined and accordant UI, performance, stability, and innovation. If you are fond of nan GNOME desktop and want to usage an immutable distribution, CarbonOS is nan 1 you want.

2. Fedora Silverblue

Like carbonOS, Fedora Silverblue uses GNOME and it's immutable. And there's different similarity: Both distros usage rpm-ostree for managing updates. Rpm-ostree is simply a hybrid image/package guidance strategy that makes immutable distributions possible. Both besides dangle connected Flatpak apps. 

Also: 5 Linux distros that return a small activity retired of nan box, but are truthful worthy nan effort

To beryllium honest, nan biggest quality betwixt carbonOS and Fedora Silverblue is that carbonOS is independent, while Fedora Silverblue is based on, well, Fedora. And because Fedora is simply a well-established distribution (unlike carbonOS, which is comparatively new), it brings nan benefits of a larger community. Essentially, Fedora Silverblue is Fedora, only immutable; therefore, if you for illustration Fedora and you want an immutable OS, Silverblue is nan measurement to go.

3. VanillaOS

VanillaOS is different immutable distribution that uses nan GNOME desktop, which makes for a reasonably speedy learning curve. VanillaOS delivers a somewhat untouched GNOME environment, but you tin ever tweak it pinch immoderate extensions you want. However, nan developers person included a fewer extensions, specified arsenic Apps Menu, Auto Move Windows, Places Status Indicator, Removable Drive Menu, System Monitor, User Themes, Window List, and Workspace Indicator. 

Also: I tried a Linux distro that promises free, built-in AI - and things sewage weird

The large quality betwixt VanillaOS and either carbonOS aliases Fedora Silverblue is that this distribution is an amalgamation of Debian, Ubuntu, Alpine, Fedora, Arch, and openSUSE, which is made imaginable by nan Apx package guidance wrapper. With Apx, you tin instal applications from various sources (apt, dnf, pacman, zypper, Flatpaks, AppImages, and moreover Android apps). This intends you'll person a immense array of applications to take from, each nan while utilizing an immutable operating system.

Like carbonOS and Fedora Silverblue, VanillaOS is simply a general-purpose operating system, truthful you tin easy usage it arsenic your desktop OS. If you want an immutable Linux distro that uses GNOME but gives nan desktop situation a spot much user-friendliness, VanillaOS is simply a awesome choice.

4. blendOS

Similar to VanillaOS, blendOS allows you to instal apps from various sources (RPM, DEB, etc). BlendOS is besides beautiful. This immutable distribution allows you to take from a assortment of desktop environments, including GNOME, KDE Plasma, XFCE, Cinnamon, MATE, Deepin, and LXQt. The Deepin type of blendOS is particularly pleasing to nan eye. 

Also: This is my favourite Linux distro of each clip - and I've tried them all

The biggest quality betwixt blendOS and nan others connected this database is that blendOS tends to cater to developers. The distro ships pinch Electron 25, Hardware Locality Isotope, Neovim, Qt Assistant, Qt Designer, Qt Linguist, Qt QDBus View, Qt V4L2 trial Utility, Qt V4L video seizure utility, Software Token, and Podman -- each of which are geared toward developers. That doesn't mean you can't use from blendOS, but you'll request to return nan clip to instal nan apps you want (such arsenic LibreOffice, GIMP, etc). 

If I had to transportation blendOS to nan mean user, I'd astir apt susurration successful their ear, "Try 1 of nan different distributions first."

5. Nitrux

Nitrux is based connected Debian. Combine that pinch immutability, and you tin guarantee this distribution is rock-solid arsenic they come. Once upon a time, Nitrux utilized nan KDE Plasma desktop arsenic a ground for nan NX Desktop and included MauiKit Applications. However, arsenic of this June, nan developers opted to spell a different way pinch Hyprland and its utilities + Waybar + Wlogout. 

Hyprland is simply a tiling model manager, which makes Nitrux retired of scope for astir mean users. However, if you want an incredibly businesslike desktop, this is nan measurement to go.

Also: I instal these 11 apps connected each caller Linux system, and you should, excessively - here's why

Nitrux has besides shifted from nan Liquorix kernel to nan Cachy option, because Liquorix still does not see a spot to alteration PSI (which is basal for Waydroid to function). Nitrux besides shrugs disconnected nan systemd init strategy for OpenRC. On apical of that, Nitrux uses nan XanMod kernel, which includes a fewer features to make it moreover much unchangeable and responsive. Those features see kernel caching, afloat multicore artifact furniture runqueue, BBRv2 TCP congestion control, ORC Unwinder for stack traces, high-responsiveness multitasking Task Type scheduler, and respective third-party spot sets. 

All of this comes together to make Nitrux a very fast, immutable distribution. 

Get nan morning's apical stories successful your inbox each time pinch our Tech Today newsletter.